CVE-2018-12532 | BDVDB-2026-102768 Detail

Description#

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/104503
https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html
http://seclists.org/fulldisclosure/2020/Mar/21

Exploit#

No public exploit known

History#

Version 12018-06-18Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.